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Abstract of JP2002073433 

PROBLEM TO BE SOLVED: To provide a break-in detecting 
device which detects illegal break-in by judging from packets, 
and if illegal break-in occurs, takes measures to prevent 
illegal break-in. 

SOLUTION: In a computer network system, the break-in 
detecting device 100 is provided with the following: a 
communication means 110; a packet analyzing means 120 
that determines whether or not the illegal break-in is 
proceeding by analyzing the received packets; a measure 
means 1 30 that if it is judged that the illegal break-in is 
proceeding, performs closing of protocol processing or ports, 
shutting down of communication and the like; an illegal 
break-in monitoring means 140 that monitors whether or not. 
the attack of illegal break-in and the like is terminated; and a 
measure removing means 1 50 that if it is judged that the 
attack of illegal break-in and the like is terminated, removes 
the measures of shutting down of communication and the 
like. 
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•y h^A^iE&^'y hS-^aj-TS^^-y h##fg& 
k. 

fc. *IE&/^-y htffSA-fS^IElf A^ffiih-r?.«® 

t immt zmt iz k ^wak-fsftxstaii 
a. 

jus/** •/ f#ffasottffli6«^^T jje*e«a 

<05H£HgU ±E^IE<fAa 5 **7-f £^jEftA**7 

ofSA^»^a. 

- ? * & tf / ^ h Sr^lE^ -y h t-t h Z b 

ztmttmxm i 2E»*>ftAi*ttiSB. 

[11*114 ] ±l£/^-y h#flr2&l2. 7*s«-ri.T 
k LT , lira b 3/P^#:kiift,-K- 

•r k * t -th msm s &momx®mim* 

k LT . 7jEft^y- -x hoafifcill/rf k £tf fit 

■ri.ii*« i *^ 4 ^■f*u&»tE»^aAtwasa. 

JJEftAtWaSSBi. 

±a»«t»t J: -5 T&$ LT v >fcafistf-h«OffilB#+ 
jh5*rcn**£. JJBflM LT^^iift.+r- h k Ml 

mfevMfErc^tot&Mfix-hffisigti&ffiz.&zb 
mm k -timm stmoi*. xtmm.. 

[I9*«7 3 IfEfiA&ftgBli. £<bt=. 
^ME^^-yhOgg3W»7Lfc«^fc:. ffiffl£*itL 

fciiffi^- j* <r>mm z?mi. ±.tmm#- vmmz 
hzb zft®btm?im6i?Mcoi%x&m.s. 

[ff*«8 ] ffi fBStmSk . ±£ffi«5a^l!lkii 
k i^iEftAttSHf I^fAtSv^ . 

±ieffiA^»sa(i. 

±125(1 Lt^y HS:$MrL. #ffiL*/^-y NO* 

*»4>te^^ . y h $-^ai-ri>A-ir .y h^SfgPk . 

C, TjRr'**-* hJ^Af-S*IEf^*Gfrjtf 
S-kSttSlg&k. 



IMittmmz X -> T ffi ffl LT v ^fflfltf- h <0ffiffl#+ 
jLS*i"0***£, JJBteJBLTVvfcaflsK-hkiiJSl 
03Ifi^-h^^-7VL. *- rvLttlft^-h*- 

mmm£s.^mmm®x-yMmb m 

k> 

±M?m%mmz x *> x gft l f * « v ^Tafi 

1 4 JREftA*«IHP IvXf A . 

JJPREftA^aESBSfflL. ±ie^IE<SA* { »7tl) 
7IffA^7 SrffllSft 4 ^iEffi A%M& b , 
±E^IEffAiaigl5tCctoT. ^jEftA»7S:WBrLfc 
JJB5FEftA^B5±-r4»JS*JSfKst4««jfl» 

Si5k, 

bOSfI* 5 *l7L?t^t. ffiffl^+±L 

h coB^^±fEffifg^a^a^®fl]-ri»^ifSAJi 

SSL. 

4 n$$[ 8 IBa<7)^iEfI A»^S y^fA. 

[ mm io] A7 7 h agist . 

liv^-y b-ftmxmTTtts^'yhzmaiiznte 

tC, ^I^A'ir-y hj&sfftA-tS^jEflUSrffijh-f **ME 
£ k &H*ISk ^fil^4C k feWftt ■tiftAttJai* 
ft. 

[ hmm 1 1 ] iMmxmmmit. § c, 

JJB*jEftX«*il**aL . ±S^EftA* s »7-t«. 
^EttA»7i*IBrr 6^1E« AlsffiCSk , 
JJe^iEftAiaSlSCi-jT. ^iEf5A»7*WBrL 

mimb£ffiz.z>zbz:mLbtm%mi oiesscofs 
7^a*ft. 

[000 1] 

•y h9-.^^rAtWtl>i^T'$>l.. 
[0002] 

[^5fe0^j] 07ti. fyljiff. ^ggspi 1-17 7 5 
9 7 (^*fl^ff X&i±®mtt #.'N/lz«-^< }«*c7)f5 

7ti» /^-y h<7)jt<l7Ciy)r HU^*»4>?FiEr^-fex*> 
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5*»«»fLJ: 3 Htfc^T. 5 Oit 

*4. 53 j ( j =1~N) fcfcK-h- (PHY : m 
ffi) T*4. 

[0003] <W=. IWtontlfflti. HfciJH 
T. £7. 3VV-A«te6»4«lfc»^ri-* I P ( I 
nternet Protocol)? Kl-'XCOffiHI: 

A/SOIl ARP (Address Resolut 
ionProtocol)7 flSafljltf) 
I P7HUX*«^. ^£0jSfl7Cl P7KU-*#. -X 
«U5UCtH»SiiTV»*HF«rSfifcI P7HU**>« 
fflfc***l$r^*£tt. ^jE&Jg^tf^-yh?-?^ 
«SifCVi*kflKL. WW'fiRK-h 5 3 j *t-9* 
*5 2*»feflJD8it. 
[0004] 

[JHftWfifcLJ: -3 ttftWi] f^flW»itllMBtt 

x^m^x-mtx^tz. wzth. t^'Ho 

fiA£a>TE^&g#TC*>fe7?-feX7l>i§£\ TOEfcfll 
XX'hhlzii^hh-T. 3\IR:^7-y r-T*>*fc«Br 

[ 0 0 0 5 ] *fc , ftAtffiitTifcftfciK- h £ » 0 

n vy-zi/frfe^JKyuiMtti: n->fc*S#*>J*ft 

Iftfc LXWiX'hhtf. voi-Ctad^BKSilTV^ 
?■ A £ »B-f 4 fcftfctt , *IE>5rff A^'ff *>fLT * » tfl 

If*. 

[0006] £*>JMWi. ±1W>J: 3&BBLftHWW- 
4Jttf>fc&§iX7ti><9T. ^IEfiA<?5&fc]£^7y h<0 
g*TO*5:<A'7:y hfrfePBrf 4C1 t fclWfc* 
4. Sfc. ^jRW-yr- TiEfiASrRfiit 

fc. 3FEftA**fri5*iT$rft*itf. SBRSivOtfraa 

*]m74d>:£Bftfc74. 
[0007] 

mmt. xy-v h«ras«**a««i: . ±ieattsa f 

^jE*^7-v h£#!iJ74A7y . JJE'<7 



[0008] ±Mz®*.mmmt. $fet. ±ie^7-y 

«U ±ETOfA* i ^77l»^iEffiA^75-*'JllT7l» 
^EffAiSiStSSi:. ±|p|\EftAiaR»3&«. 'FIEftA* 
TtflKLfc**. J:fe#S!gP* { fc4±t5*iE<fA£|iJ5 

±+*m*tittetttimmmk izt 
[00093 •/ h*«fa5(4. waw-if- 

9 i*tt'*? t t- Sr^E^N*7 7 b T-£>4 t 74 £ b i 

mtti. 

[0010] ±I2A'7 -y b*«HBtt, WJt«t*-f- 

[ooii] ±tmmmt. *E.®Am±-thttmt 
4. 

[0012] jbEW*«w\ Mftnmb ix.mi 
x^mtix-wmz'Pki. ±m%A&Mm 

it. Sfefc. ±E«JR«CJ:->TttffltTV^a«sK- 

^-htttafKoafi^-ht^-ryu. ^-r>ift 

fflfl-7- h £PJr^Mft7L^a*Q74afttf- b»*nSB 

[0013] ±IBftA«««6Btt, $ fefc. TI=5r/N-7 
•y h«)Wt*«»7Lfc«^(C. 'ttffl«r+±Lfca«df- 
h^ffl^S^t. ±Ea«^-h^SH!*±E]5r«^- 

a<K^a»rr *^E«A»7aa»*flii ■& - 1 ^ 

[0014] ;o^C^I»^iEfS7v*fm« : a>-^T^ 

a. mm&M.b. i.mmmmw.bmmi'fri 
^flWJttums^f-Afcfco-c . ±iefSA^^a 

Ji. ±ea««t^LT^-yh«ra3Kttfta«« 

b. J«ftU:.'N-7-yl>r#tfrU ^tff L^A'7-y b 
O+frfeTORr/t^-y b$r^tK7l»A-7-y h^SSt. 
±12^-7 y h^«fa5T'^jE^A7 ••/ b S-^JU Ufc*^ 

iz. T-tt'^v htf&M-httm?^m±-tz>m 
Zbhiim^b. iMttm&izx^xmLx^tzmm 

afi^-ht«4S'JOfflft^-ba:7-7yL. 7-7V 

hattasfcarfii^. iEflfflwaasaifi. ±iea««^ 
w •■/ h * a«-r* t . ±iaaft-7- h m%m>b 
mmzixzmmx- h z%mz> &%m&b . ±k&s 
mmzx ->x%.\% item*- 1 zm^xmmt&z b 
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mt-th. 

[0015] jjE«y.twjsiWi. § t><z; ±ie^FiE(i 

ioT, ^flWjft7£«flrLfc*£. JJOTUSA* 

±iaffifgjas^a^ii»'t-i>^]Ef«A^7)i»^t &m 

ttfcgfi l . ±£r^7 'J #- hK«Wi. JJEftJB 
[0016] i^)»HK*4ftA«aai*ffi{i, A-^r „ h 
hfflftJMt . ISW'v hftfflgT^jEfc 

tt®xm±t&ttm t mmiMtiffiz. izt 
[0017] ±immm-m. $ 4> t. jje*ie« 

7£ffl^**]EftAiSaigfc. JJE^iffiAEax 
gCJ^T. ^jEflyj»7*«BrLfc*-&. JJBPFiEfi 

[00181 

ofSA^n^S5.^ffA^a*ft^^-r^sfe<?ijoii«[i 

TftS. B1W»V»T. 10 0tiSE(ILfe'f*-y r-t*t 
UT^EffiA3WT**iT sWf A»Sr»«f L . <5A*«ff 

MUOiaK&l* HOW <*■ 7 h £ SflKliftft-f 

SiHS#K (iifiSIS) 1 2 0{iSflU7tA^.y 

hiCpiET-ftfc^S^&WBr-rS^y-y h»*f¥S (a* 
^•y h»«r») TJb*. 1 3 Otta<iiBIWS0>*l**fT 

(*mhb) -chi. 1 4 o»i*tf&#ai s o 

«») 1 5 0«*jE{5AIs?jl#ai 4 OASRE 

fflA#fTfcitTir vfirV^fcflKr 5Ifligffir¥0# 

BJ«*T'(i. /^»M4. *>y h«7-?±£Sai!»£T 
Or-?* L . «H£0>r- * fc» I, T ^ * *>tt "tti 

[00 1 9 3 ttfeCO^TBa £JBwrljiBj|-f 

4. *r. iixmmmwi o on. iifi^ai i oizx 

OH*** h7-^*»V<^ y r-*rgfltl> ( S 1 
0 ) . *LT . ., h#«r#R l 2 0 <C«fc Y 



o) . i>u %muz'*>--yhtf^]E-chz>k%muz 

(S3 0T-Ye s ) , »«#Rl 3.0fc<t 0^77 
ha+ffiifrfc-f . fflflfciSilrf * ( S4 0 ) . >L 
T ; ft Afc»SB 1 0 0 U . TOEftAHB* R 14 0* 

<7>«k 3 ( S 5 0 ) . i U 3\E{SA#fir4rfl 

TV^kflBrLfc«*(S6 0fYes) . ftSSftfBfc 
#Rl5 0£Evveffl©H8r£»|lfcL (S70) . /t* 

•y hto*mzmmti> (sso . 

[0020] J2Lhf5 «k 5 fc, ^E*^#><0f«, 3&c 

A*WE«'5ra*5D6»4>ft AL i p t LT tfSA^^ffl 

[ 0 0 2 1 ] ^EftAiai^a 1 4 0 tWKfill^ 
1 5 0 *m»& ZblzX*). 7iE<5A* { *IT L/c 4> 

[0022] a-^t 7 hc^tff^rffiowcov^TSi 

( 1 ) A'^7 hrtK#4*lT^**W8»3-F^«aE 

( 2 ) -^B#ra^-5iiii±o«<7)y^7 h ^«ift-r§ 

[00233 *(C, JJE ( 1 ) «W-^7 -y^-y^O 
01J2-3O. JJB ( 2 ) O^tffl^r^SO^S 1-P^-T. 

t. ^-;U-t-A'(i, ||jjr»7. H»f^fjE»fc»ftL 
3 fir<«rS. i^)«»ttttt-f4feftK:{i. ^7^1^ 

Destination Port = 25 (SMTPt 
TCPt-9 

m<r> s m t p 3 -7 y Kasifta* 1 2 8A*-( htLL*^ 

"helo", "mail from:", "rcpt 
to:", "vrfy", "expn" 

(C(±. P o p ( Po s t Office Protoc 
o 1 ) tJJLTt*) 1 ). JJfili, *<4Tt>HflT& 
2>. 4fc. ^-;P-t-AX<7)?ScSCJ±. smtp (Si 
mple Mail Transfer Protoc 
o 1 ) a?y K$rfiJfflLTJ— if^ • a— fofilS&H' 

[00 24 3 A*^-y-?7f-y/2 : FTP cwd 
"rootifeS^JD^S. 
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Z<?)%&£%\ihb. f tp (F i 1 e Transf 
er Protocol) t-^'ti. 

Sftft. Wz#>. rtzy-Yyr-ovmowgtcyT 

'fto7a77A>£-t-yhT-y?2tl. HffSftT. ft 
yiztox oft frEiMWi t ft . 

TCPN-/^ 

Destination P o r t = 2 1 ( FTP -C 
ONTROL) TCPf-^ 

" c w d "root" <n>%¥ft&frMth . 

"cwd'li. f tp-CflWHSfiaWWavyh'-cfc 

ft. ±ietJU'^3v>'K2:ffl^s^fct)"5r«gt**)S. 

[00 2 5] /^-y7 7f^3 : h ttp phf 

.r?)#g££ltfti:, http (Hyper Text 
Transfer Protocol) "t— A{i. )V— 

T-yTSft. HffSftT, h 1 1 Pt-A'«|;||f 
WKfcft'TtBtta 1 **. £WR»fc*Wirt-ftfctf>fc 

Destination Port=80 (HTTP) 
TCPf-? 

"get", "/phf" ea&m tuoath . 

Phfli, To^A^l-rC**. ±E£ttt4>7D 
[0026] ttHm#i£l : SYN777 Y&WVi 

mm (?-t'z*m idosj ***>-w) . 

£tf>9»fc 5 ft ft fc . S YN A^T -y r-*fjtW);fc*>fc y v 

ft*tf>Cli. -jgs*Brt (Witf. 1 0#IB) J-UT 

izmth^y htf-f&BR. (mm. 1 o o®) m 

±*fta*S**4H»r?ft. 

I P^-yfff)De s t i n a t i o n Address 

TCP (Transmission Control 
Protocol) ^y^c7)S.YN77^>'l . AC K 
7 7^0. 

SYN777H (SYN-f loodlli, Jfc^Ol 

ft. 

[ 0 0 2 7 ] fcfc. «AISa*>WK-30T D o SK&P) 
«^fcov»TK*-ft. Do S#5£tc*r-r&(fA#*?7 
L^*>S^Ofllgr(S» -JgB^fflrt (f?U«i\ 1 OfHSJ) 



WUewCir-y r-tf-Jtfflft 1 0 Offl) WT 

znutimtx-KKxhiin. 

[ 0 0 2 8 ] Srfe. ±IBItlt0&JB 1 OWTIi, *f&£ 
U\ &^»/h<r)ffli*miK. £a?- 
•y ><«MS:5KBrf ft 7 r#Sft$*V$r< 

fcft. *ZX\ .ty&nWSmzttX i cmp, tc P , 
u d ptHoitTn r- n/l^lcAT-.y h<Mt£ff*>&» 
J: 5 fc -f ft d 1 1 J: -> T . £A?- -y r- T^r < BW 
h^yhmfiimtXLXW it:. TahajUcI 
bXUKK. tcpXIiudp (Use r Patag 
ram Protocol) COX- r-S-f&lCjlfgjglfr 
T&ZtizX^X. I«fty<4r» r-ttjE*teJHlT*ft 
J:3fcH*LTt>'J:v*. -HiLT, 

5<r>J^~, htzVZmt&Zblz* 
0. Webt-A'^77-feX (tcp,-K-h§^-8 
0 ) f\ F TP ( t cp#- h##2 1 ) «oa«*fflriB 
fc&ft. jJMt5E/5fe^rHU^rtfcjM«:aBf 
•fftJ^tCttfRLTiiO. tcpO-fc-yxay 
SrfliLTff 5*»c*tl,Tli. res* t A^ry b£ 
iMfit ft I I C <fc 0 t c P -fe -y 3 V LT t, J: 

C 0 0 2 9 3 ttSI^K ! 3 0#«9#ft*Bflfc LT . T 

(B) aWHCffLTS»ty7 htjSflTfft ({£«- 
^^Ji-r) 

(C ) ^-eoi«ff&3Ef (*Jk 0 - *B#a§AJ&S&fc& 
io-ttft) 

[0030] ilfiojgirti, A A^»^S 1 0 0M£ii 

sramitftiR^is ftA^a^s i o o^mztu-z^ 

tr-yh-kXZl&mLXhXHl^ -&mmiX t J: 

«-«A7 . y h srsssi-r ; t izx^xmmth . t 

jt» 7'oha;K7)7D-Xti, jIftroh3;^|aj-<7) 
a't- -y h 2r®*1-ft C t (w J: oTHtTf ft . 
[003 1 3 4^. iOS0S<0»JBi-Cti. a- t- 7 r-^ff 
#ai 2 0K:J:-jT. ^EftAsWJiajSiifcat.. Mfi 
TO6>4>«A«3aSRitl 0 0W7 htigiS^ixft. (I 
AttSSai 0 0^lEiM$iXftA7--y Ki. A7" y 
flf^Kl 2 OCiottTW^y h* J 7J"W$it. tJ-W 
&mzm^X. ^EfJtTJKB^S 14 014. ^IftA 
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[0032] S^tC. ±MWX *I«AlftiB«. 

-y vm^n. 1 2 oii. ftA&aga i o o cgs 

&Xol,zlXl>Xi\ ttchh. ?REttA««Ba. «aj 

[00 3 33 ^-Wyf^tlnSf-? 
tlX. iMWawH. ra^7A« t 9»&«:fflv^ 

[00 34] VJ±®XolZ. ztytjL-9*yhV-9 
jEttAtfffirtlT ^&*>S*>£fl§rt *> -y h#|Jr# 

a. ( c ) ^m%xmihtix^z>tws\itz%&. ? 

[ 0 0 3 5 3 5EJC. JJEft A^tt^fifi, WTO^aSr 
Hi. 5. 

( d ) ^EfiA^#^ { &7L£*>S*>£i£$tl>^ 
IftAIHBm ( e ) *iEftA**>3*W»7 U:k 

a. 

[00363 9mm&2 . Oh^OtO»SrCJi. fS 
A&ttHS 1 0 0 (cfcL tVr -y h#ffi#a 1 2 0 . jkfflf 

#ai 3 02K«tJHSffli*»i 5o#. Rtaathes 

. *l«t*. ft A^JD^ai 0 014. immbtix^z 
*>»7LT^4*»S:«SSatcffl3aiti. «®satt. 
ii»Ort^fcU^*>'oT^gat^^^X«StBg 

[00371 ifi«3 . JSLh^satojejii i t-(4. 

TOIA$*vO^*£tf>*t8iLT, »«SrifflffiLfc 
L*-). fit'. fcte. Ea^t^-yhSriiiiS-e-ife 
[0038303 (4. C<7)J: 3 =Sr*§£<0*IEfg A*f £ff 

wi'XT&z tat MWi<r>m&(MX'S) h . m s iza \, > 
sanga-?** . 3 o j ( j = i - n ) umm<?m® 



nmz'fi o mmtmsiW 3 o j 

[00393 04(4, ffA^»^a2 0 0<r)ffi$M<r>- 
mX'hh. 04Cl*iUT. 2 1 0\Wv h£SflX(4 
aMW* ilfl^a ( iiflSP ) T* * . 2 2 0 (4gft L£ 

Ytf^iEx-h&b*§fr*nmh>^v 
a (A-^-y biwm) xhh. 23o&mmmm<r)tt 
mz'if ottmm 231 a^va?? 

•Mm) 2 4 0(4A'^y h^«f#a2 2 0^J: 

*]EttAlS«#R (7EfSA^^5) T**. 2 5 0(4 
^FIEfSAK«#a2 4 0*qraE«A**ff*rfir o*V»i: 

a (ttjfflBlfeffi) T'&l>. 2 5 1 (4, ^jEftABa^S 
2 4 0jBORE« AtffHrtiT-O^fcWSr Lfc*&.. 

flM*aa£*3 o j (j = i, • • • . n > tsuflu, 

'jWK7 L>I k SriWBt **IE« A87il»#a (^iEff 
A»7a»«)T*4. 

[0040 3 05(4; 1f$g«ffi^a30j (j=l, • 
• • , N) <O«jfiBW)-0lT2b*. 05(Cfe^t, 3 1 
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